CVE-2024-11238
Landray EKP sysUiComponent.do delPreviewFile path traversal
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- November 15, 2024
- Published Date
- November 15, 2024
- Last Updated
- November 15, 2024
- Vendor
- Landray
- Product
- EKP
- Description
- A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Es wurde eine kritische Schwachstelle in Landray EKP bis 16.0 gefunden. Dabei betrifft es die Funktion delPreviewFile der Datei /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. Durch Manipulation des Arguments directoryPath mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS Scores
CVSS v4.0
6.9 - MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS v3.1
6.5 - MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v3.0
6.5 - MEDIUM
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v2.0
6.4
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P
EPSS Score
- Score
- 0.27% (Percentile: 50.74%) as of 2025-06-14
SSVC Information
- Exploitation
- poc
- Automatable
- Yes
- Technical Impact
- partial
Exploit Status
- Exploited in the Wild
- Yes (2025-06-02 00:00:00 UTC) Source
References
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| The Shadowserver (via CIRCL) | 2025-06-03 12:00:19 UTC |
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel